Hello All,
I am trying to parse the output of a relevance and want to find the ‘BootStartTime’ and boot ’ BootEndTime’. While i am saving the output in a text file i am able to get the required details.
XML i am using
<Event
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Diagnostics-Performance" Guid="{cfc18ec0-96b1-4eba-961b-622caee05b0a}"/>
<EventID>100</EventID>
<Version>2</Version>
<Level>2</Level>
<Task>4002</Task>
<Opcode>34</Opcode>
<Keywords>0x8000000000010000</Keywords>
<TimeCreated SystemTime="2023-09-11T17:51:40.5629492Z"/>
<EventRecordID>313</EventRecordID>
<Correlation ActivityID="{50f25ab8-e4d8-0003-ded1-f250d8e4d901}"/>
<Execution ProcessID="1588" ThreadID="9500"/>
<Channel>Microsoft-Windows-Diagnostics-Performance/Operational</Channel>
<Computer>LP1-AP-51961993.PROD.HCLPNP.COM</Computer>
<Security UserID="S-1-5-19"/>
</System>
<EventData>
<Data Name="BootTsVersion">2</Data>
<Data Name="BootStartTime">2023-09-11T17:49:30.6301777Z</Data>
<Data Name="BootEndTime">2023-09-11T17:51:37.2369645Z</Data>
<Data Name="SystemBootInstance">22</Data>
<Data Name="UserBootInstance">22</Data>
<Data Name="BootTime">78073</Data>
<Data Name="MainPathBootTime">31273</Data>
<Data Name="BootKernelInitTime">42</Data>
<Data Name="BootDriverInitTime">4229</Data>
<Data Name="BootDevicesInitTime">531</Data>
<Data Name="BootPrefetchInitTime">0</Data>
<Data Name="BootPrefetchBytes">0</Data>
<Data Name="BootAutoChkTime">0</Data>
<Data Name="BootSmssInitTime">9796</Data>
<Data Name="BootCriticalServicesInitTime">1250</Data>
<Data Name="BootUserProfileProcessingTime">580</Data>
<Data Name="BootMachineProfileProcessingTime">2</Data>
<Data Name="BootExplorerInitTime">8752</Data>
<Data Name="BootNumStartupApps">32</Data>
<Data Name="BootPostBootTime">46800</Data>
<Data Name="BootIsRebootAfterInstall">false</Data>
<Data Name="BootRootCauseStepImprovementBits">0</Data>
<Data Name="BootRootCauseGradualImprovementBits">0</Data>
<Data Name="BootRootCauseStepDegradationBits">0</Data>
<Data Name="BootRootCauseGradualDegradationBits">0</Data>
<Data Name="BootIsDegradation">false</Data>
<Data Name="BootIsStepDegradation">false</Data>
<Data Name="BootIsGradualDegradation">false</Data>
<Data Name="BootImprovementDelta">0</Data>
<Data Name="BootDegradationDelta">0</Data>
<Data Name="BootIsRootCauseIdentified">false</Data>
<Data Name="OSLoaderDuration">1378</Data>
<Data Name="BootPNPInitStartTimeMS">42</Data>
<Data Name="BootPNPInitDuration">1667</Data>
<Data Name="OtherKernelInitDuration">149</Data>
<Data Name="SystemPNPInitStartTimeMS">1759</Data>
<Data Name="SystemPNPInitDuration">4173</Data>
<Data Name="SessionInitStartTimeMS">5991</Data>
<Data Name="Session0InitDuration">5624</Data>
<Data Name="Session1InitDuration">93</Data>
<Data Name="SessionInitOtherDuration">4078</Data>
<Data Name="WinLogonStartTimeMS">15787</Data>
<Data Name="OtherLogonInitActivityDuration">6149</Data>
<Data Name="UserLogonWaitDuration">12601</Data>
</EventData>
The relevance i am using is
( node value of child node of selects "Data[@Name='BootStartTime']" of it,node value of child node of selects "Data[@Name='BootEndTime']" of it) of selects "/Event/EventData" of xml document of file "C:\Users\hello\Downloads\relevance.xml"
A: 2023-09-11T17:49:30.6301777Z, 2023-09-11T17:51:37.2369645Z .
When i try to parse the output from the relevance i am getting the following error:
`( node value of child node of selects "Data[@Name='BootStartTime']" of it,node value of child node of selects "Data[@Name='BootEndTime']" of it) of selects "/Event/EventData" of ((xmls of records whose (event id of it = 100 AND now - time generated of it < 30*day) of event log "Microsoft-Windows-Diagnostics-Performance/Operational" )) as xml`
E: The operator "xml" is not defined.
Please advice on this ?